# Samba TODO ``` TEST: Add echo locDCpass1 | bin/rpcclient ncacn_np:$SERVER -UAdministrator -c getusername echo locDCpass1 | USER=administrator bin/rpcclient ncacn_np:$SERVER -c getusername -> https://gitlab.com/samba-team/samba/-/merge_requests/1271 Migrate s3 client code to cli_credentials -> https://gitlab.com/samba-team/samba/-/merge_requests/1362 SMB.CONF: SMB_SIGNING_VALS="default|off|if_required|desired|required" Create one function translating signing state string to enum see set_cmdline_auth_info_signing_state and enum_smb_signing_vals Add 'server smb encrypt' (done) -> smb encrypt as alias Add 'client smb encrypt' (done) smbclient -e => getop => lp_do_param(client smb encrypt) => cli_creds reads lp_client_smb_encrypt() Add cli_credentials_set_smb_singing(), cli_credentials_set_smb_ipc_signing(), cli_credentials_set_smb_encryption(). - DONE Use cli_creds smb encryption: tig -7 b06e7ea5cbc0e46c0c42d6cdeb3a14f3cf21f1c6 - DONE Check do_connect() in client.c CMDLINE CLI: -> parse popts -> set password callback, if not --use-krb5-ccache and not --use-ccache and not --no-pass and not auth-file --use-kerberos=yes|auto|no|default default only if we add 'client use kerberos' as smb.conf option --use-krb5-ccache imply --use-kerberos=yes --krb5-cache=$PATH - DONE '-U... -k' => --use-kerberos=yes '-k' without -U => --use-krb5-cache --use-krb5-ccache and --use-ccache => not supported, TODO: --use-winbind-ccache that provides generic support for krb5 and ntlm Rename --use-ccache to --use-winbind-ccache (removes --use-ccache?) - DONE Add --smb-signing=$SMB_SIGNING_VALS also set GENSEC_FEATURE_SIGN for desired/required --signing=$SMB_SIGNING_VALS (as legacy) '-S $SMB_SIGNING_VALS' ??? (only smbclient?) '-S' check what smbtorture is actually using Remove -S for signing and use only long option Add --smb-encryption=$SMB_SIGNING_VALS -e => --smb-encryption=required also set GENSEC_FEATURE_SEAL??? => defer to --gensec-protection Remove -e and use only long option Implemented --client-protection=off|sign|encrypt TODO: what about 'net'... break it and use options as above Add the following??? --gensec-client-protection=[default,seal,sign,plain] => see also "ldap client sasl wrapping" => default from "gensec client protection" LATER: TODO: --use-pkinit ``` ## NEW TODO popt pw-nt-hash Remove smb_encrypt from client.c Remove smb_encrypt from cli_cm_connect() Add smb_cmdline_sanity(long_options) POPT_COMMON_LEGACY_S3 POPT_COMMON_LEGACY_S4 client ldap sasl wrapping -> directly use gensec add support for client-protection Remove cli_credentials_set_machine_account_pending()